The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's installation section explicitly directs the user to run pip install graphifyy. The double-y suffix in the package name is a common pattern for typosquatting attacks targeting developers who intended to install a legitimate tool named "graphify".\n- [REMOTE_CODE_EXECUTION]: By instructing the installation and execution of a potentially malicious package (graphifyy), the skill risks executing arbitrary code on the user's system during the pip install or the subsequent graphify build . command.\n- [COMMAND_EXECUTION]: The skill documentation encourages the execution of several shell commands, including package installation, a tool-specific build command, and multiple subcommands via a local Node.js script (cavekit-tools.cjs).

graphify-integration